Method and system for answering online certificate status protocol (OCSP) requests without certificate revocation lists (CRL)

ABSTRACT

Methods and systems in accordance with the present invention efficiently validate digital certificates by answering Online Certificate Status Protocol (“OCSP”) requests without Certificate Revocation Lists (“CRL”). During validation of digital certificates, these methods and systems speed transmission, reduce required bandwidth and reduce required data storage by eliminating the need for the transmission of lengthy CRLs from a Certificate Authority (“CA”) when verifying a digital certificate from a client. In one implementation, they send a Lightweight Directory Access Protocol (“LDAP”) database query to a CA directory server to determine and pinpoint the existence of a valid digital certificate and check its validity without receiving a long list of data, such as a CRL, from a CA. The CA directory server returns the query result, and the database query in the CA directory server is performed faster than using an entire CRL, and furthermore, the transmission of the database query result is a small piece of information and does not require the large amounts of data transmission bandwidth and storage as required with transmitting CRL&#39;s.

FIELD OF THE INVENTION

The present invention generally relates to data processing systems, andmore particularly, to digital certificates and their validation.

RELATED ART

With the advent of the Internet and the increasing use of large computernetworks by millions of people world-wide, security against fraudbecomes a paramount concern. Conducting business in the currente-commerce environment requires a level of security that can withstandintentional attempts by malicious hackers and imposters, as well asprotect against accidental erroneous information due to unintentionaltechnological errors. The ability to determine the correct identity ofan online entity remains vital to e-commerce and many other computingenvironments, applications, and purposes. One such way of identifyingonline identities is through the use of digital certificates.

Digital certificates, or “certificates,” are a form of electronicidentification used by computers, analogous to, for example, a driver'slicense. They may be an attachment to an electronic message, and theyattest that the issuing authority certifies that the data associatedwith the certificate, such as the email address of the certificateholder, is indeed accurate and trustworthy for the lifespan of thecertificate. A certificate may be used for encrypting messages for theholder, and to verify signatures created by the holder. Digitalcertificates are described in detail in “Understanding Public-KeyInfrastructure: Concepts, Standards, and Deployment Consideration,”Carlisle Adams et al., New Riders Publishing (1999), and “DigitalCertificates: Applied Internet Security,” Jalal Feghhi et al.,Addison-Wesley (1999) which are incorporated herein by reference.Certificates provide a highly-secure, bi-directional security mechanism.Not only can individual certificate holders ensure that their emails andother messages are cryptographically secure, recipients can alsoauthenticate the identity of a message's sender. In addition, users canverify the integrity of commercial web sites with which they mightperform transactions, and those same sites can use certificates toreplace traditional username and password access control mechanisms.

For instance, username and password combinations are not secure. Ifsomeone steals a username and password, he can gain access to controlleddata protected by the stolen username and password from anywhere in theworld. It also leaves no easy way of notifying all access-controlledsites that the username and password have been compromised. A user hasto remember every unique combination of usernames and passwords forevery access-controlled site with which they interact.

Certificates have expiration dates after which they are no longer valid,but they may be revoked prior to that date for a variety of reasons.Like any other kind of identification, such as a credit card or driver'slicense, a certificate is given a finite lifespan. It expires, and oncethat expiration date is reached, it must either be renewed or replaced.Validation is the act of checking the status of a certificate to seewhether or not it has been revoked. Revocation is the process of markinga previously-valid certificate as invalid.

Certificates are typically issued by Certificate Authorities (“CA”)which are trusted third-party organizations or companies that issuedigital certificates used to create digital signatures andpublic-private key pairs. The role of the CA in this process is toguarantee that the individual granted the unique certificate is, infact, who he or she claims to be. For example, this may mean that the CAhas an arrangement with a financial institution, such as a credit cardcompany, which provides it with information to confirm an individual'sclaimed identity. CAs are an important component in data security andelectronic commerce because they insure that the two parties exchanginginformation are really who they claim to be. An individual wishing tosend an encrypted message applies for a digital certificate from a CA.The CA issues an encrypted digital certificate containing theapplicant's public key and a variety of other identificationinformation. The CA makes its own public key readily available throughprint publicity or perhaps on the Internet. The recipient of anencrypted message uses the CA's public key to decode the digitalcertificate attached to the message, verifies it as issued by the CA andthen obtains the sender's public key and identification information heldwithin the certificate. With this information, the recipient can send anencrypted reply.

CA's may also revoke certificates. The circumstances under whichrevocation may happen vary widely, but can include, for example, achange of employment status, theft of a computer containing thecertificate's associated private key or other vital private information,or cancellation of the anticipated transaction for which the certificatewas originally issued. The mechanism for revoking a certificate variesby CA, but generally, the issuer of the certificate issues adigitally-signed statement marking a particular certificate's serialnumber as revoked. This statement typically comes in the form of aCertification Revocation List (“CRL”).

FIG. 1 illustrates an exemplary CRL 210 in accordance with the presentinvention. A CRL 210 is the digitally-signed data issued by a CAspecifying the serial numbers 102 of digital certificates it has revokedprior to their indicated expiration date. Generally, it is a long listof serial numbers 102 of revoked digital certificates, and the listitself is digitally signed by the CA. The CRL 210 may also have a CRLheader 104 that has additional information including, for example, theissuer's name and other information.

The Online Certificate Status Protocol (“OCSP”) is a commonly used,real-time online mechanism for getting up-to-date status information ondigital certificates. It is offered by the Internet Engineering TaskForce (“IETF”) as a proposed industry standard for certificatevalidation and is widely used. OCSP is described in greater detail in“Understanding Public-Key Infrastructure: Concepts, Standards, andDeployment Consideration,” Carlisle Adams et al., New Riders Publishing(1999), which was previously incorporated herein by reference. On anetwork such as the Internet, when a client computer makes a transactionrequest to a server computer, it may supply a certificate forauthentication, and the server computer may verify the client identityusing the certificate. It typically does so by sending an OCSP requestto an OCSP computer which checks the validity of the certificate with aCA.

FIG. 2 shows a system for answering OCSP requests with CRL's. A clientcomputer 202 makes a transaction request over a network to a servercomputer 204 having the ability to process the client's requestedtransaction, such as an e-commerce application. When making thisrequest, the client computer 202 sends a certificate to the server sothat the server may verify that the client has the authority to make therequest and receive results of the transaction. Upon receipt of thetransaction request and the certificate, the server 204 attempts toverify the certificate before executing the requested transaction bymaking an OCSP request to an OCSP responder 206. To do so, the server204 constructs an OCSP request based on the received certificate andsends the OCSP request to the OCSP responder 206. To construct therequest, the server 204 extracts information such as serial number fromthe certificate and/or some other environment information (such as IP,user name, subject dn) that can be derived from the certificateinformation. The information put into the request may be used by theOCSP responder 206 to locate the certificate that needs to be validated.Then, it puts that information in an OCSP request.

Generally, the CA 08 may periodically automatically publish a CRL 110 tothe OSCP server 206 at timed intervals. Alternatively, the OCSPresponder 206 may send a CA request to the CA 208. The CA requesttypically includes a request for a CRL 210. This request to the CA maypass through a firewall 212 between the OCSP responder and the CA 208.The firewall 212 prevents unauthorized access to the CA where the CA'ssigning keys are kept. If a CA's signing key is stolen, the certificatesmay become compromised. Upon receipt of the request from the OCSPresponder 206, the CA 208 returns a CRL 210 to the OCSP responder 206.Notably, the CA 208 does not search for a specific serial number 102corresponding to the digital certificate in question, but rather returnsa lengthy list representing revoked certificates.

Upon receipt of the CRL 210, the OCSP responder 206 stores the receivedCRL 210. Depending on the size of the CRL 210, the OCSP responder 206may break the CRL into pieces which it may then store in memory 306 oron a storage device 310. The OCSP responder 206 searches the CRL 210 tosee if the certificate in the original request is on the CRL 210 bydetermining if the serial number 102 of the certificate is representedin the CRL. If the OCSP responder 206 determines that it is included inthe CRL 210, it determines that the certificate has been revoked. TheOCSP responder 206 notifies the server 204 which, in turn, rejects theclient's transaction request. If the OCSP responder 206 does not findthe certificate's serial number on the CRL 210, it determines that it isvalid. In this case, the OCSP responder 206 notifies the server 204 thatmade the original OCSP request, and the server 204 accepts thecertificate, processes the client transaction, and returns thetransaction results to the client 202.

Some systems pose a problem in that the CRL 210 that is returned to theOCSP responder 206 is a lengthy piece of data, that may be, for example,a hundred megabytes. The returned CRL contains much unneeded databecause, typically, only the serial number(s) of the requestedcertificate(s) is desired, leaving the large majority of the informationsuperfluous. This inefficient manner of verification not only presentsbandwidth problems in the transmission of such large amounts of datafrom the CA 208 to an OCSP responder 206, but also storage problemsbecause it is stored on the OCSP responder when received. The problemmay compound when multiple OCSP requests are made to the CA 208, andmultiple CRLs 210 are returned. These problems also reduce the speed inwhich electronic identifications can be verified. As such, answering anOCSP request with a CRL 210 may create inefficiency and unnecessarytransmission and storage of large amounts of unrelated information. Itis, therefore, desirable to overcome these and related problems.

SUMMARY OF THE INVENTION

In accordance with the present invention, a method in a data processingsystem for validating digital certificates is provided comprising thesteps of receiving an online certificate status protocol requestassociated with a digital certificate, and creating a LightweightDirectory Access Protocol database query based on the received request.It further comprises sending the Lightweight Directory Access Protocoldatabase query to determine whether the digital certificate is valid,and receiving a database query result indicating whether the digitalcertificate is valid.

Furthermore, in accordance with the present invention, a method in adata processing system for validating digital certificates is providedwherein the data processing system has a certificate authority and anassociated database. The method comprises receiving, by a database, aLightweight Directory Access Protocol query based on an onlinecertificate status protocol request indicating a requested digitalcertificate, and searching the database for a database record reflectingan identity of the requested digital certificate. Further, it returns anindication of the database record when the database record reflectingthe requested digital certificate is found to indicate validity of therequested digital certificate, whereby the indication of the databaserecord is returned without transmission of a certificate revocation listby the certificate authority.

Additionally, in accordance with the present invention, a dataprocessing system for answering online certificate status requestswithout certificate revocation lists is provided that comprises a memoryhaving program instructions and a processor. The processor is configuredto execute the program instructions to receive an online certificatestatus protocol request associated with a digital certificate, create adatabase query based on the received request, send the LightweightDirectory Access Protocol database query to determine whether thedigital certificate is valid, and receive a Lightweight Directory AccessProtocol database query result indicating whether the digitalcertificate is valid.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory onlyand are not restrictive of the invention, as claimed.

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate one (several) embodiment(s) ofthe invention and together with the description, serve to explain theprinciples of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate an embodiment of the inventionand, together with the description, serve to explain the advantages andprinciples of the invention.

FIG. 1 illustrates an exemplary Certificate Revocation List;

FIG. 2 depicts an OCSP system using CRLs for digital certificateverification;

FIG. 3 shows an exemplary computer system suitable for use in accordancewith the present invention;

FIG. 4 illustrates a Certificate Authority and a Certificate Authoritydirectory server in accordance with the present invention;

FIG. 5 depicts a system for answering OCSP requests without CRLs inaccordance with the present invention; and

FIGS. 6A–B are flowcharts depicting steps for answering an OCSP requestwithout CRLs in accordance with the present invention.

DETAILED DESCRIPTION

Methods and systems in accordance with the present invention efficientlyvalidate digital certificates by answering OCSP requests without CRLs.During validation of digital certificates, they speed transmission,reduce required bandwidth and/or reduce required data storage by, forexample, eliminating the need for the transmission of lengthy CRLs froma CA when verifying a digital certificate from a client.

In one implementation, methods and systems in accordance with thepresent invention enable requesters to pinpoint the existence of adigital certificate and check its validity by sending a database query,such as a Lightweight Directory Access Protocol (“LDAP”) query, to a CAdirectory server associated with a CA. In this way, the status ofdigital certificates can be determined without requiring the CA totransmit a long list of data, such as a CRL. The CA directory serverreturns the query result, and if there is a matching certificaterepresented in the CA directory server, then the OCSP responder knowsthat the certificate is valid. The database query in the CA directoryserver is performed much faster than when an OCSP responder searches anentire CRL. Furthermore, the transmission of the database query resultis a small piece of information and does not require the large amountsof data transmission bandwidth and storage as required with CRLs,thereby increasing validation speed.

Computer Architecture

FIG. 3 is a block diagram that illustrates a computer system 300 inwhich methods and systems consistent with the invention may beimplemented. Computer system 300 may represent any of the computersdiscussed herein (e.g., client 202, Server 204, OCSP responder 206, CA208, Certificate Authority directory server 402) and is not limited to aclient or server or otherwise, and embodiments in accordance with thepresent invention are not limited to any specific combination ofhardware and/or software.

Computer system 300 includes a bus 302 or other communication mechanismfor communicating information, and a processor 304 coupled with bus 302for processing information. Computer system 300 also includes a mainmemory 306, such as a random access memory (“RAM”) or other dynamicstorage device, coupled to bus 301 for storing information andinstructions to be executed by processor 304. Computer system 300further includes a read only memory (“ROM”) 308 or other static storagedevice coupled to bus 302 for storing static information andinstructions for processor 304. A storage device 310, such as a magneticdisk or optical disk, is provided and coupled to bus 302 for storinginformation and instructions.

Computer system 300 may be coupled via bus 302 to a display 312, such asa cathode ray tube (“CRT”), for displaying information to a computeruser. An input device 314, such as a keyboard, is coupled to bus 302 forcommunicating information and commands to processor 304. Another type ofuser input device is cursor control 316, such as a mouse, forcommunicating with processor 304 and for controlling cursor movement ondisplay 312.

Computer system 300 also includes a communication interface 318 coupledto bus 302. Communication interface 318 provides a two-way datacommunication coupling to a network link 320 that may be connected tolocal network 322. For example, communication interface 318 may be amodem, for example, to provide a data communication connection. Asanother example, communication interface 318 may be a local area network(“LAN”) card to provide a data communication connection to a compatibleLAN. Wireless links may also be implemented. In any such implementation,communication interface 318 sends and receives electrical,electromagnetic or optical signals that carry digital data streamsrepresenting various types of information.

Network link 320 typically provides data communication through one ormore networks to other data devices. For example, network link 320 mayprovide a connection through local network 322 to a host computer 324 orto a wide area network (“WAN”) such as the Internet 328. Local network322 and Internet 328 both use electric, electromagnetic or opticalsignals that carry digital data streams. The signals through the variousnetworks and the signals on network link 320 and through communicationinterface 318, which carry the digital data to and from computer system300, are exemplary forms of carrier waves transporting the information.

System Details

LDAP is a protocol for accessing information directories. It supportsTCP/IP which is widely used for Internet access. LDAP facilitates theaccessing of directory information to various applications running onvarious computer platforms, and because LDAP is an open protocol,applications need not be concerned about the type of server hosting thedirectory.

A directory is like a database and generally tends to contain moredescriptive, attribute-based information. The information in a directoryis generally read much more often than it is written. As a consequence,directories usually do not implement the complicated transaction orroll-back schemes regular databases use for doing high-volume complexupdates. Directory updates are typically simple all-or-nothing changes,if they are allowed at all. Directories are typically tuned to givequick responses to high-volume lookup or search operations. They alsomay have the ability to replicate information widely in order toincrease availability and reliability, while reducing response time.

Different methods of providing a directory service allow different kindsof information to be stored in the directory, and place differentrequirements on how that information can be referenced, queried andupdated, how it is protected from unauthorized access, etc. Somedirectory services are local, providing service to a restricted contextwhile others are global, providing service to a much broader context(e.g., the Internet). Global services may also distributed, meaning thatthe data they contain is spread across many machines, all of whichcooperate to provide the directory service.

Often information in directories is based on entries. In manyimplementations, the LDAP directory service model is based on entriesthat may be arranged in a hierarchical tree-like structure. An entry isa collection of attributes that has a name, called a distinguished name(“DN”) that is used to uniquely refer to the entry. Furthermore, each ofthe entry's attributes may have a type and one or more values, and thevalues depend on what type of attribute it is.

For accessing the directory information, LDAP defines operations forinterrogating and updating the directory. Operations are often providedfor adding and deleting an entry from the directory, changing anexisting entry, and changing the name of an entry. However, LDAP is mostcommonly used to search for information in the directory. An LDAP searchoperation allows some portion of the directory to be searched forentries that match some criteria specified by a search filter, andinformation can be requested from each entry that matches the criteria.

LDAP directory services may be based on a client-server model, in whichone or more LDAP servers contain the data making up the LDAP directorytree. A client typically connects to an LDAP server and asks it aquestion by submitting a query. The server responds with an answer(query results), or with a pointer to where the client can get moreinformation (e.g., another LDAP server). In most global directoryservices, regardless of which LDAP server a client connects to, it seesthe same view of the directory; a name presented to one LDAP serverreferences the same entry it would at another LDAP server. LDAP isdescribed in greater detail in “LDAP: Programming Directory-EnabledApplications with Lightweight Directory Access Protocol,” Timothy Howeset al., MacMillan Technical Publishing (1997), and “Understanding andDeploying LDAP Directory Services,” Timothy Howes et al., MacMillanNetwork Architecture and Development Series, New Riders Publishing(January 1999), which are incorporated herein by reference.

FIG. 4 shows that a CA 208 may be configured to publish or record acertificate to a CA directory server 402 when a certificate is issuedand unpublished or delete the certificate when a certificate is revoked.In one implementation, a CA directory server 402 is a database thatstores records reflecting certificates. When a CA 208 issues a newcertificate, it publishes the certificate to the CA directory server 402by creating a certificate record a certificate record which stores theissued certificate, and additional meta-information including acertificate status (“cert-status”). Since the certificate itself doesnot indicate if it is revoked or not, this piece of informationspecifies its status. In one implementation, the cert-status field mayreflect a status of “valid,” “invalid,” “revoked,” “expired,” or“revoked_(—)expired” by, for example, storing a value corresponding toeach type of status. When the CA 208 revokes the certificate, itunpublishes it in the CA directory server 402 by sending it theappropriate cert-status information. In turn, the CA directory server402 updates the corresponding database record. The CA directory server402 keeps an up-to-date database of valid certificates, and this processhelps implement the rapid and efficient validation of certificates.

FIG. 5 depicts a system for answering OCSP requests without CRLs 210 inaccordance with the present invention. As can be seen on this figure,the OCSP responder 206 sends a database query, such as an LDAP query, tothe CA directory server 402 instead of sending a CA request to the CA208. In turn, the OCSP responder 206 receives a database query resultindicating if a match was found, thereby indicating the existence of avalid certificate. Thus, it need not receive a large and cumbersome CRL210 to validate the certificate.

FIGS. 6A and 6B are flowcharts depicting steps for answering an OCSPrequest without CRLs 210 in accordance with the present invention, andthey will be discussed in conjunction with FIG. 5 to illustrate animplementation in accordance with the present invention. First, theclient 202 issues a transaction request to the server 204 with acertificate (step 602), and the server 204 receives the transactionrequest and certificate (step 604). Before executing a transaction, theserver 204 verifies the certificate with the request by constructing anOCSP request based on the received certificate (step 606). In oneimplementation, the server extracts the serial number from thecertificate and puts it in the OCSP request in the “CertID” field. Theserver 204 then sends the OCSP request to the OCSP responder 206 (step608).

Next, the OCSP responder 206 constructs an LDAP query based on thecertificate serial number 102 (step 610), for example, found in the“CertID” field of the OCSP request. The query may be constructed in oneof many ways to uniquely identify the certificate. In someimplementations, the LDAP query requests the entire database recordcorresponding to the certificate to be returned, and in otherimplementations, only the cert-status field is requested. Onealternative constructs the query based on an extension that contains thesubject name of the certificate. After construction of the query, itsends the request to the CA directory server 402 (step 612).

The CA directory server 402, which has records of valid certificates andoptionally revoked certificates (as discussed in connection with FIG.4), receives the query, searches accordingly (step 614) and returns anentry if the query is able to locate one. If a matching entry is found(step 616), the CA directory server 402 returns an indication that amatching entry was found (step 618), and this indication is typically asmaller piece of information than a CRL 210. Upon receipt, the OCSPresponder 206 then considers the certificate valid, and notifies theserver 204 (step 622) which accepts the certificate and processes theoriginally requested client transaction (step 624) and returns theresults to the client 202 (step 626).

If the CA directory server 402 does not find a matching entry (step616), it notifies the OCSP responder 206 (step 620) which then considersthe certificate revoked, unknown, invalid or expired. The OCSP responder204 notifies the server 204 that made the OCSP request (step 628), andthat server rejects the client's transaction request (step 630).

Other embodiments of the invention will be apparent to those skilled inthe art from consideration of the specification and practice of theinvention disclosed herein. For example, server 204 may be configured togenerate and send LDAP queries to CA 208 and process results of thesequeries. Furthermore embodiments of the present invention may beimplemented by computer programs that may be stored on computer-readablemedia. It is intended that the specification and examples be consideredas exemplary, with a true scope and spirit of the invention beingindicated by the following claims.

1. A method in a data processing system for validating digitalcertificates having a server, an Online Certificate Status Protocol(OCSP) responder, and a certificate authority associating a certificatedatabase including records associated with digital certificates, themethod comprising: receiving, at the OCSP responder, an OCSP requestassociated with a digital certificate generated by the server; creating,by the OCSP responder, a Lightweight Directory Access Protocol databasequery based on the received OCSP request; sending, by the OCSPresponder, the Lightweight Directory Access Protocol database query tothe certificate database associated with the certificate authority todetermine whether the digital certificate is valid; receiving, at theOCSP responder, a database query result indicating whether the digitalcertificate matches a corresponding certificate entry stored in one ofthe certificate database records, wherein the certificate databaserecords store certificates and corresponding certificate informationreflecting status of the certificate, permissible values of thecertificate information including at least “valid,” “invalid,”“revoked,” “expired,” and “revoked expired”; determining, by the OCSPresponder, the validity of the digital certificate based on the databasequery result; and notifying the server of the determined validity of thedigital certificate.
 2. The method of claim 1, wherein the LightweightDirectory Access Protocol database query includes an instruction toreturn a selected portion of a database record.
 3. The method of claim1, wherein the method further comprises: sending an indication of a newdigital certificate from the certificate authority to the certificatedatabase upon issuance of the new digital certificate; receiving, by thecertificate database, from the certificate authority, an indication ofthe new digital certificate; and creating a certificate database recordreflecting an identity of the new digital certificate.
 4. The method ofclaim 1, wherein the method further comprises: sending an indication ofa revoked digital certificate from the certificate authority to thecertificate database upon revocation of the revoked digital certificate;receiving, by the certificate database, from the certificate authority,the indication of revocation of the revoked digital certificate; andremoving a certificate database record associated with the revokeddigital certificate from the certificate database.
 5. A method in a dataprocessing system for validating digital certificates withoutcertification revocation lists, the data processing system having aclient, a server, a responder, a certificate authority associating adatabase storing records of valid digital certificates of thecertificate authority, the method comprising: generating, by the client,a request for a transaction, the request including a digital certificateidentifying the client; receiving the client request by the server;creating, by the server, an online certificate status protocol requestbased on the associated digital certificate identifying the client;sending, by the server, the online certificate status protocol requestto the responder; receiving, by the responder, the online certificatestatus protocol request associated with the digital certificate;creating, by the responder, a Lightweight Directory Access Protocoldatabase query based on the received online certificate status protocolrequest; sending, by the responder, the Lightweight Directory AccessProtocol database query to the database associated with the certificateauthority to determine whether the digital certificate is valid;searching the database for a database record identifying the digitalcertificate associated with the online certificate status protocolrequest, wherein the certificate database record stores a certificateand corresponding certificate information reflecting status of thecertificate, permissible values of the certificate information includingat least “valid,” “invalid,” “revoked,” “expired,” and “revokedexpired”; returning a LDAP database query result indicating whether thedatabase record identifying the digital certificate is stored in thedatabase; sending, by the responder, a validity indication whether thedigital certificate is valid based on the query result to the server;and sending, by the server to the client, an indication of whether thetransaction is authorized based on the validity indication.
 6. A dataprocessing system for answering online certificate status requestswithout certificate revocation lists, comprising: a memory havingprogram instructions; a processor configured to execute the programinstructions to: receive from a server an online certificate statusprotocol request associated with a digital certificate, create aLightweight Directory Access Protocol database query based on thereceived request, send the Lightweight Directory Access Protocoldatabase query to a database associated with a certificate authority todetermine whether the digital certificate is valid, receive aLightweight Directory Access Protocol database query result from thedatabase indicating whether the digital certificate matches acorresponding entry stored in a database one of the certificate databaserecords, wherein the certificate database records store certificates andcorresponding certificate information reflecting status of thecertificate, permissible values of the certificate information includingat least “valid,” “invalid,” “revoked,” “expired,” and “revokedexpired”, determine the validity of the digital certificate based on thedatabase query result, and notify the server of the determined validityof the digital certificate.
 7. A data processing system for answeringonline certificate status requests without certificate revocation lists,comprising: a client computer configured to send a request for atransaction, the request including a digital certificate identifying theclient; a server computer configured to receive the client request,create an online certificate status protocol request based on theassociated digital certificate identifying the client, and send theonline certificate status protocol request; an OCSP responder configuredto receive the online certificate status protocol request associatedwith the digital certificate, create a Lightweight Directory AccessProtocol database query based on the received online certificate statusprotocol request, and send the Lightweight Directory Access Protocoldatabase query to determine whether the digital certificate is valid; acertificate authority that provides valid digital certificates; and adatabase associated with the certificate authority storing records ofvalid certificates of the certificate authority and configured to searchfor a database record identifying the digital certificate associatedwith the online certificate status protocol request, return an LDAPdatabase query result indicating whether the digital certificate matchesone of the records stored in the database, wherein the certificatedatabase records store certificates and corresponding certificateinformation reflecting status of the certificate, permissible values ofthe certificate information including at least “valid,” “invalid,”“revoked,” “expired,” and “revoked expired”, wherein the OCSP responderdetermines that the digital certificate is valid when it receives anLDAP database query result reflecting that the digital certificatematches one of the database records.
 8. A computer-readable mediumcontaining instructions for controlling a data processing system toperform a method for validating digital certificates, the dataprocessing system having a server, an Online Certificate Status Protocol(OCSP) responder, a certificate authority associating a certificatedatabase including records associated with digital certificates, themethod comprising the steps of: receiving, at the OCSP responder, anOCSP request associated with a digital certificate generated by theserver; creating, by the OCSP responder, a Lightweight Directory AccessProtocol database query based on the received OCSP request; sending, bythe OCSP responder, the Lightweight Directory Access Protocol databasequery to the certificate database associated with the certificateauthority to determine whether the digital certificate is valid;receiving, at the OCSP responder, a database query result indicatingwhether the digital certificate matches a corresponding certificateentry stored in one of the certificate database records, wherein thecertificate database records store certificates and correspondingcertificate information reflecting status of the certificate,permissible values of the certificate information including at least“valid,” “invalid,” “revoked,” “expired,” and “revoked expired”;determining, by the OCSP responder, the validity of the digitalcertificate based on the database query result; and notifying the serverof the determined validity of the digital certificate.
 9. Thecomputer-readable medium of claim 8, wherein the Lightweight DirectoryAccess Protocol database query includes an instruction to return aselected portion of a database record.
 10. The computer-readable mediumof claim 8, wherein the method further comprises: sending an indicationof a new digital certificate from the certificate authority to thedatabase upon issuance of the new digital certificate; receiving, by thedatabase, from the certificate authority, an indication of the newdigital certificate; and storing a database record reflecting anidentity of the new digital certificate.
 11. The computer-readablemedium of claim 8, wherein the method further comprises: sending anindication of a revoked digital certificate from the certificateauthority to the database upon revocation of the revoked digitalcertificate; receiving, by the database, from the certificate authority,the indication of revocation of the revoked digital certificate; andremoving a database record of an identity of the revoked digitalcertificate.
 12. A computer-readable medium containing instructions forcontrolling a data processing system to perform a method for validatingdigital certificates, the data processing system having a certificateauthority and a directory server having an associated database, themethod performed by the directory server comprising: maintaining adatabase of valid digital certificates; receiving a LightweightDirectory Access Protocol query based on an online certificate statusprotocol request indicating a requested digital certificate; searchingthe database for a database record reflecting an identity of therequested digital certificate; and returning an indication of thedatabase record when the database record reflecting the requesteddigital certificate is found to indicate validity of the requesteddigital certificate, whereby the indication of the database recordincludes meta-data reflecting the validity of the requested digitalcertificate, permissible values of the meta-data including at least“valid,” “invalid,” “revoked,” “expired,” and “revoked expired”.
 13. Thecomputer-readable medium of claim 12, wherein maintaining a databasefurther comprises: sending an indication of a new digital certificatefrom the certificate authority to the database upon issuance of the newdigital certificate; receiving, by the database from the certificateauthority, an indication of the new digital certificate upon issuance ofthe new digital certificate; and storing a database record reflecting anidentity of the new digital certificate.
 14. A computer-readable mediumcontaining instructions for controlling a data processing system toperform a method for validating digital certificates withoutcertification revocation lists, the data processing system having aclient, a server, an responder, a certificate authority associating adatabase storing records of valid digital certificates of thecertificate authority, the method comprising: generating, by the client,a request for a transaction, the request including a digital certificateidentifying the client; receiving the client request by the server;creating, by the server, an online certificate status protocol requestbased on the associated digital certificate identifying the client;sending, by the server, the online certificate status protocol requestto the responder; receiving, by the responder, the online certificatestatus protocol request associated with the digital certificate;creating, by the responder, a Lightweight Directory Access Protocoldatabase query based on the received online certificate status protocolrequest; sending, by the responder, the Lightweight Directory AccessProtocol database query to the database associated with the certificateauthority to determine whether the digital certificate is valid;searching the database for a database record identifying the digitalcertificate associated with the online certificate status protocolrequest, wherein the certificate database record stores a certificateand corresponding certificate information reflecting status of thecertificate, permissible values of the certificate information includingat least “valid,” “invalid,” “revoked,” “expired,” and “revokedexpired”; returning a LDAP database query result indicating whether thedigital certificate the database record is stored in the database;sending, by the responder, a validity indication whether the digitalcertificate is valid based on the query result to the server; andsending, by the server to the client, an indication of whether thetransaction is authorized based on the validity indication.
 15. A dataprocessing system for validating digital certificates, comprising: meansfor receiving an OCSP request associated with a digital certificategenerated by a server; means for creating a Lightweight Directory AccessProtocol database query based on the received OCSP request; means forsending the Lightweight Directory Access Protocol database query to acertificate database associated with a certificate authority includingrecords associated with digital certificates to determine whether thedigital certificate is valid; means for receiving a database queryresult indicating whether the digital certificate matches acorresponding certificate entry stored in one of the certificatedatabase records, wherein the certificate database records storecertificates and corresponding certificate information reflecting statusof the certificate, permissible values of the certificate informationincluding at least “valid,” “invalid,” “revoked,” “expired,” and“revoked expired”; means for determining the validity of the digitalcertificate based on the database query result; and means for notifyingthe server of the determined validity of the digital certificate. 16.The method according to claim 1, wherein the server and the OCSPresponder reside in a first computer network, the certificate authorityand the certificate database reside in a second computer network, andthe first computer network is connected to the second computer networkvia a computer network firewall.